Audit log

Every state-changing event for Web3Auth: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-11-11 20:13:06Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 468,253,140

   sig

   61KD8EMzhRuD…36SrVAVUcopyexplorer ↗

   hash

   J8bi1XuAd1SR…mi3UzdyNcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (10054 B) ▸

   {"actor":"system:backfill","investigation_id":"61ee9311-640d-4c0e-9f2f-f3ad4f335fa5","kind":"publish","page_slug":"web3auth","published_at":"2026-11-11T20:13:05.969Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Web3Auth","sections":[{"content":"Starting around November 6, 2026, users of the Keplr wallet who had created their accounts via Google or Apple social login (powered by Web3Auth's embedded-wallet infrastructure) reported unauthorized transactions draining their funds. Keplr co-founder Josh Lee stated on social media that the incident \"was not a hack of Keplr's code\" and that it originated at Web3Auth, the provider Keplr uses for social login, according to The Block's reporting. Web3Auth separately described it as a \"security issue in its own infrastructure,\" per The Hacker News. Keplr disabled Google and Apple sign-in while investigating. Wallets created with a recovery phrase or hardware device were reported as unaffected.","heading":"November 2026 Keplr Social-Login Incident","severity":"critical","sources":[{"credibility":2,"name":"The Block: Web3Auth says it frontran hackers by moving $5.6 million out of exposed Keplr wallets","type":"news_article","url":"https://theblock.co/news/defi/2026-11-08-web3auth-says-it-frontran-hackers-by-moving-5-6-million-out-of-exposed-keplr-wallets-436029"},{"credibility":2,"name":"The Hacker News: Web3Auth flaw exploited to steal Keplr wallet funds","type":"news_article","url":"https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html"}]},{"content":"Public estimates of the financial impact conflict and have not been reconciled by either company. Keplr co-founder Josh Lee estimated that roughly 20% of Keplr's Google/Apple social-login accounts could be affected, though he said only a fraction of those appeared to be actually exploited. On-chain analytics firm Bitquery initially reported that at least $6.01 million had moved out of more than 44,000 wallets, characterizing this as theft; Bitquery subsequently revised its analysis, treating much of that movement as Web3Auth's own rescue transfers, while noting it cannot independently verify who controls the recovery addresses. Security firm GoPlus separately estimated at least $1 million stolen, without detailing its methodology. Web3Auth published a list of twelve recovery addresses, which The Block found held approximately $5.6 million at the time of publication, spanning Cosmos-family and Ethereum-style chains. Web3Auth disputed the higher theft estimates, saying some flagged transactions were its own whitehat recovery transfers mistaken for attacker activity. Neither Web3Auth nor Keplr has published an official total-loss figure.","heading":"Scale of losses disputed and unreconciled","severity":"high","sources":[{"credibility":2,"name":"The Block: Web3Auth says it frontran hackers by moving $5.6 million out of exposed Keplr wallets","type":"news_article","url":"https://theblock.co/news/defi/2026-11-08-web3auth-says-it-frontran-hackers-by-moving-5-6-million-out-of-exposed-keplr-wallets-436029"},{"credibility":2,"name":"The Hacker News: Web3Auth flaw exploited to steal Keplr wallet funds","type":"news_article","url":"https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html"}]},{"content":"As of this review, neither Web3Auth nor Keplr had publicly disclosed the technical mechanism of the private-key exposure, when an attacker first exploited it, or whether the vulnerability had been fully closed. Web3Auth paused its embedded wallet and login services during the investigation; The Hacker News reported the company's status page still showed the login service down at the time of its article. Web3Auth stated its initial investigation found no evidence that MetaMask users were affected, despite Web3Auth being marketed as the infrastructure behind \"MetaMask Embedded Wallets\" following Consensys's acquisition of Web3Auth in June 2025. Web3Auth said the underlying issue could affect other companies' services built on its infrastructure, but had named only Keplr publicly at the time of reporting.","heading":"Root cause undisclosed; service paused","severity":"high","sources":[{"credibility":2,"name":"The Hacker News: Web3Auth flaw exploited to steal Keplr wallet funds","type":"news_article","url":"https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html"},{"credibility":2,"name":"The Block: Web3Auth says it frontran hackers by moving $5.6 million out of exposed Keplr wallets","type":"news_article","url":"https://theblock.co/news/defi/2026-11-08-web3auth-says-it-frontran-hackers-by-moving-5-6-million-out-of-exposed-keplr-wallets-436029"}]},{"content":"Web3Auth said it used the attacker's own access route to proactively move funds from other at-risk wallets into designated \"secure recovery wallets\" across eleven Cosmos-family chains and eight Ethereum-style chains before attackers could reach them, working with Keplr's maker. It said the moved funds are safe and that it is working on a process to return them to affected users, without specifying a timeline or mechanism as of the reporting reviewed. Keplr advised affected users not to send new funds to, re-import, or recreate affected accounts; to move any remaining unstaked and unlocked funds to a wallet secured by a recovery phrase or hardware device; to trust only official communications; and warned of scammers offering fraudulent \"recovery\" assistance via direct messages. The Hacker News reported that the first fund-moving transaction occurred 21 minutes before Web3Auth's first public notice of the issue, and that approximately 86% of affected wallets were emptied (by attacker or by rescue transfers) after the wallet maker's public warning.","heading":"Response, mitigation, and user guidance","severity":"medium","sources":[{"credibility":2,"name":"The Hacker News: Web3Auth flaw exploited to steal Keplr wallet funds","type":"news_article","url":"https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html"},{"credibility":2,"name":"The Block: Web3Auth says it frontran hackers by moving $5.6 million out of exposed Keplr wallets","type":"news_article","url":"https://theblock.co/news/defi/2026-11-08-web3auth-says-it-frontran-hackers-by-moving-5-6-million-out-of-exposed-keplr-wallets-436029"}]}],"sources_used":[{"credibility":2,"name":"The Block: Web3Auth says it frontran hackers by moving $5.6 million out of exposed Keplr wallets","type":"news_article","url":"https://theblock.co/news/defi/2026-11-08-web3auth-says-it-frontran-hackers-by-moving-5-6-million-out-of-exposed-keplr-wallets-436029"},{"credibility":2,"name":"The Hacker News: Web3Auth flaw exploited to steal Keplr wallet funds","type":"news_article","url":"https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html"},{"credibility":2,"name":"BeInCrypto: Keplr Wallet Hack Hits Google and Apple Users as Recovery Begins","type":"news_article","url":"https://beincrypto.com/keplr-wallet-hack-google-apple-login-users/"},{"credibility":2,"name":"CryptoTicker: Keplr Wallet halts Google and Apple login after Web3Auth flaw drains accounts","type":"news_article","url":"https://cryptoticker.io/en/keplr-wallet-web3auth-social-login-exploit/"}],"summary":"Web3Auth is a social-login / embedded-wallet key-management infrastructure provider, acquired by Consensys in June 2025 and now also marketed as MetaMask Embedded Wallets, used by apps including the Keplr wallet. Beginning around November 6, 2026, a security flaw in Web3Auth's infrastructure allegedly exposed private keys for some wallets created via Google or Apple social login inside Keplr, leading to unauthorized transactions; Web3Auth paused its embedded wallet and login services and said it moved funds from other at-risk wallets into recovery addresses before attackers could reach them. Public reporting on the scale of losses is inconsistent and unreconciled, and neither company had published a full root-cause or incident report at the time of this review.","timeline":[{"date":"2025-06","event":"Consensys acquires Web3Auth, which the company subsequently markets as part of \"MetaMask Embedded Wallets.\"","source":"The Block","source_url":"https://theblock.co/news/defi/2026-11-08-web3auth-says-it-frontran-hackers-by-moving-5-6-million-out-of-exposed-keplr-wallets-436029"},{"date":"2026-11","date_original":"2026-11-06","event":"Keplr users report unauthorized transactions from wallets created via Google/Apple social login; Web3Auth discloses a security issue in its infrastructure and pauses its login and embedded wallet services; Keplr disables Google and Apple sign-in.","source":"The Hacker News / The Block","source_url":"https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html"},{"date":"2026-11","date_original":"2026-11-07","event":"Web3Auth says it began moving funds from other vulnerable wallets into recovery addresses; Bitquery reports approximately $6 million moved from more than 44,000 wallets, initially characterized as theft.","source":"The Block","source_url":"https://theblock.co/news/defi/2026-11-08-web3auth-says-it-frontran-hackers-by-moving-5-6-million-out-of-exposed-keplr-wallets-436029"},{"date":"2026-11","date_original":"2026-11-08","event":"Web3Auth publishes a list of twelve recovery addresses, found to hold roughly $5.6 million; disputes higher theft estimates, saying some flagged transfers were its own rescue operations.","source":"The Block","source_url":"https://theblock.co/news/defi/2026-11-08-web3auth-says-it-frontran-hackers-by-moving-5-6-million-out-of-exposed-keplr-wallets-436029"},{"date":"2026-11","date_original":"2026-11-09","event":"The Hacker News reports Web3Auth's login service still shown as down on its status page; GoPlus estimates at least $1 million stolen; Bitquery revises its analysis of the recovery addresses.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 54af3c81-fcd2-4361-b849-0a6f26eec881copy